registry / @zuplo/editor / 1.0.38982071387
@zuplo/editor@1.0.38982071387
Local development editor for the Zuplo CLI
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook or runtime self-dependency, and the inspected flagged code maps to normal editor features. The bidi-character match is part of CodeMirror special-character handling; the scanner hints alone do not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
No malicious trigger was identified; package use exposes its editor API and browser assets.
Impact
No confirmed malicious effect was identified.
Mechanism
The inspected source provides a local editor server, IDE-opening URLs, and browser editor features.
AI rationale
The manifest has no install lifecycle hook or runtime self-dependency, and the inspected flagged code maps to normal editor features. The bidi-character match is part of CodeMirror special-character handling; the scanner hints alone do not establish malicious behavior.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a local editor package and exposes editor modules; it declares no install lifecycle hook or runtime self-dependency.
- The flagged IDE-related code lists editor protocols and lets callers save a known editor preference and build a URL to open a project file.
- The other flagged cursor match styles editor cursor classes; inspected browser bundles load editor features and language workers, and CodeMirror recognizes bidi controls as special characters.
- Inspected network and worker code fits editor workflows; no confirmed malicious behavior was identified.
Evidence against
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
5 flaggeddist/client/static/js/main-BVl-AgUu.jsView file
9`+e.stack}}var me=Object.prototype.hasOwnProperty,he=t.unstable_scheduleCallback,ge=t.unstable_cancelCallback,_e=t.unstable_shouldYield,ve=t.unstable_requestPaint,ye=t.unstable_now...
L10: `).replace(Od,``)}function Ad(e,t){return t=kd(t),kd(e)===t}function jd(e,t,n,r,a,o){switch(n){case`children`:typeof r==`string`?t===`body`||t===`textarea`&&r===``||Vt(e,r):(typeof...
L11: `,``):String(n.body);return{path:t,submission:{formMethod:i,formAction:a,formEncType:n.formEncType,formData:void 0,json:void 0,text:e}}}else if(n.formEncType===`application/json`){...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/client/static/js/main-BVl-AgUu.jsView on unpkg · L9dist/client/static/js/codemirror-6ITIKbGP.jsView file
7contains invisible/control Unicode U+200B (zero width space)
height: `+(r-t)+`px`))}function d(t,n,r){var a=R(i,t),o=a.text.length,d,f;function p(n,r){return jr(e,B(t,n),`div`,a,r)}function m(t,n,r){var i=Lr(e,a,null,t),o=n==`ltr`==(r==`after`)?`left`:`right`;return p(r==
Critical
Findings
1 Critical2 High5 Medium4 Low
CriticalTrojan Source Unicodedist/client/static/js/codemirror-6ITIKbGP.js
HighCross File Remote Execution Contextdist/client/static/ts.worker-DFduhuek.js
HighSemantic Analysis Limiteddist/client/static/js/GraphiQLConsole-Dzfmvb87.js
MediumDynamic Requiredist/client/static/js/main-BVl-AgUu.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/client/static/ts.worker-DFduhuek.js
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @zuplo/editor@1.0.38982071387.
See all versions of @zuplo/editor for other recorded verdicts.
- Review the evidence and your use of @zuplo/editor@1.0.38982071387 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.